FFmpeg releases up to 9.0.2 contain an infinite loop flaw in the RTSP client routine ff_rtsp_connect() that follows 302 redirects without a limit. When an attacker controls an RTSP server, each client request can be answered with a redirect that points back to the same server or to another malicious host, causing ffmpeg to reconnect endlessly. The resulting endless loop saturates a CPU core, leading to a denial‑of‑service condition for the system or application using ffmpeg. The weakness is a classic infinite-loop flaw, identified by CWE‑835, and the CVSS score of 7.1 reflects the high impact of resource exhaustion.

The vulnerability affects all builds of FFmpeg through version 9.0.2 inclusive. Any deployment that uses this binary as an RTSP client is potentially impacted; upgrades to 9.0.3 or later eliminate the loop.

The flaw is scored at CVSS 7.1 with no EPSS data available, and it is not listed in the CISA KEV catalog. The likely attack vector is remote: an adversary that can act as an RTSP server for the target ffmpeg instance can trigger the issue by repeatedly issuing 302 redirects. Because the vulnerability relies on external responses, it does not require local code execution or user interaction; a sufficiently exposed ffmpeg instance can be targeted from outside the network.